IdP TLS termination at load balancer

[Sean Mason]

Hi There,

I'm hoping someone might be able to point me in the right direction.  I am attempting to implement the Shibboleth IdP v3.1.1 behind a load balancer which also terminates TLS instead of handling TLS in Jetty.  The setup looks like:

Client -(https:443)-> Load Balancer -(http:8080)-> Jetty9/IdPv3

I have Shibboleth running in Jetty 9 with nothing between it and the load balancer.  I am receiving the error "SAML message intended destination endpoint https://hostname... did not match the recipient endpoint http://hostname..."  The message clearly indicates what is wrong, but I am at a loss on how to resolve it and still keep TLS offloaded.  Several past discussions have noted resolving the problem by using Apache ServerName directives and AJP configuration changes, but I don't have (and prefer not to have) that piece of infrastructure in place.

Is there some Jetty and/or Shibboleth configuration beyond changing the SSO HTTP-Redirect metadata endpoint that will enable this type of setup, or will I require TLS pass-through or re-encryption at the load balancer? 

Thank you,
Sean.